Vulnerabilidades em Nextcloud
306 resultadosAnálise Vexday
Nextcloud possui 20 vulnerabilidades registradas na base, todas de severidade moderada ou inferior, com destaque para falhas de Cross-Site Scripting (CWE-79). Nenhuma vulnerabilidade está sob ataque ativo conhecido, e não há publicações recentes nos últimos 90 dias, indicando um panorama de risco estável e sem pressão imediata.
CVE-2025-47791MEDIUMNextcloud Server's test remote endpoint is not rate limitedEPSS 0.4%CVE-2026-82985MEDIUMThe Photos app's filter-based "smart albums" build their file listing using the search configuration (photosSourceFolders) of the user viewiEPSS 0.4%CVE-2024-37884LOWNextcloud Server's users can delete old versions of read-only shared filesEPSS 0.4%CVE-2022-29160LOWSensitive files/data exist after deletion of user account in Nextcloud AndroidEPSS 0.4%CVE-2026-77167HIGHAbusing the federated share endpoint, an attacker can write arbitrary rows into the oc_share_external database table. These rows persist indEPSS 0.4%CVE-2023-39957HIGHPath traversal allows tricking the Talk Android app into writing files into it's root directoryEPSS 0.4%CVE-2025-66550MEDIUMNextcloud Calendar attachments of local files are offered to downloadedEPSS 0.4%CVE-2024-52525LOWNextcloud Server User password is available in memory of the PHP processEPSS 0.4%CVE-2024-37316MEDIUMNextcloud Calendar's event create can create attachments that link to other websitesEPSS 0.4%CVE-2026-45275MEDIUMNextcloud: Authorization bypass in approval feature allows unauthorized file sharing with approversEPSS 0.4%CVE-2021-32680LOWAudit log is not properly logging unsetting of share expiration dateEPSS 0.4%CVE-2025-66515LOWNextcloud Approval app allows users to request approval for other users fileEPSS 0.3%CVE-2025-66552MEDIUMNextcloud Server admin_audit does not log all actions on files in groupfoldersEPSS 0.3%CVE-2023-28848MEDIUMCSRF protection on user_oidc login returned the expected token in case of an errorEPSS 0.3%CVE-2026-82982MEDIUMThe Approval app's approve/reject endpoint is meant to require the file's current etag as a freshness check, preventing an approver from appEPSS 0.3%CVE-2025-59788MEDIUMCross-site scripting (XSS) vulnerability in a reachable files_pdfviewer example directory in Nextcloud with versions before 22.2.10.33, 23.0EPSS 0.3%CVE-2024-37885LOWCode injection in Nextcloud Desktop Client for macOSEPSS 0.3%CVE-2026-45545HIGHNextcloud: SQL Injection in Column Type Parameter Allows Arbitrary SQL ExecutionEPSS 0.3%CVE-2025-66549LOWNextcloud Desktop discloses information when attempting to lock a file inside a end-to-end encrypted directoryEPSS 0.3%CVE-2025-66511MEDIUMNextcloud Calendar app used predictable proposal participant tokensEPSS 0.3%